Scan images in Kubernetes manifest(s) about syft HOT 3 OPEN

Hi @MPV, thanks for the suggestion. Usually Syft only scans one image at a time and produces an SBOM for a particular image, as opposed to a set of images. Would it work for your use case if there was a higher-level script that extracted a list of images referred to in a Kubernetes manifest and then looped over each one with Syft to create a set of SBOMs?

from syft.

Hi @MPV, thanks for the suggestion. Usually Syft only scans one image at a time and produces an SBOM for a particular image, as opposed to a set of images. Would it work for your use case if there was a higher-level script that extracted a list of images referred to in a Kubernetes manifest and then looped over each one with Syft to create a set of SBOMs?

@tgerla Yeah that also makes sense. I guess either solution also needs to be good (enough) at finding the image(s) from manifest(s).

Maybe there's something that's already good at that (and thus can just be combined with this), any ideas...? 🤔

from syft.

I thought the easiest way might be with a jq query on the JSON version of the Kubernetes manifest. Here is a prototype bash script that you might start with: https://gist.github.com/tgerla/3065156018f697e0040e80bee8fe7daf

I've only tested this on one single manifest (below the script in the gist) and I'm not really familiar with the manifest format, but this might be a good start! There might be a more "kubernetes-style" way to do this. Hope it is useful!

from syft.